diff --git a/.trivyignore b/.trivyignore
index d6712121..1db444a4 100644
--- a/.trivyignore
+++ b/.trivyignore
@@ -22,14 +22,13 @@
 # owner:@RonaldHensbergen
 CVE-2026-53615 exp:2026-11-15
 
-# sqlparse < 0.6.0 (pulled via dbt-core 1.12.2, which pins
-# sqlparse<0.6.0,>=0.5.5). Advisories published 2026-08-17, fixed
-# in 0.6.0: ReDoS and quadratic DoS in SQL parsing.
+# CVE-2026-53612/53613/53614: util-linux mount TOCTOU and nosuid/noexec
+# bypass. Fixed by 2.41.5-0+deb13u1 in trixie-security; no
+# python:3.14-slim digest ships it yet (checked 2026-08-21). Renovate
+# bumps the digest when upstream rebuilds; drop these entries then.
 # owner:@RonaldHensbergen
-CVE-2026-54284 exp:2026-11-15
-# owner:@RonaldHensbergen — ReDoS, same cause as CVE-2026-54284
-CVE-2026-59893 exp:2026-11-15
-# owner:@RonaldHensbergen — tokenization DoS, same root cause
-CVE-2026-59894 exp:2026-11-15
-# owner:@RonaldHensbergen — group_comments quadratic DoS
-CVE-2026-71491 exp:2026-11-15
+CVE-2026-53612 exp:2026-11-15
+# owner:@RonaldHensbergen — TOCTOU ancestor directory swap, same fix
+CVE-2026-53613 exp:2026-11-15
+# owner:@RonaldHensbergen — SUID mount nosuid/noexec bypass, same fix
+CVE-2026-53614 exp:2026-11-15
diff --git a/images/dagster/requirements-postgres.txt b/images/dagster/requirements-postgres.txt
index 5a9ace7c..4eb03ed5 100644
--- a/images/dagster/requirements-postgres.txt
+++ b/images/dagster/requirements-postgres.txt
@@ -1 +1 @@
-dagster-postgres==0.29.18
+dagster-postgres==0.29.19
diff --git a/images/dagster/requirements.txt b/images/dagster/requirements.txt
index a80c52b7..115c64a7 100644
--- a/images/dagster/requirements.txt
+++ b/images/dagster/requirements.txt
@@ -1,5 +1,5 @@
-dagster==1.13.18
-dagster-graphql==1.13.18
-dagster-webserver==1.13.18
+dagster==1.13.19
+dagster-graphql==1.13.19
+dagster-webserver==1.13.19
 msgpack>=1.2.1
 setuptools>=78.1.1
diff --git a/images/dbt/requirements.txt b/images/dbt/requirements.txt
index 79113a11..a10e9665 100644
--- a/images/dbt/requirements.txt
+++ b/images/dbt/requirements.txt
@@ -6,6 +6,11 @@
 # deepdiff<9.0,>=7.0 constraint lets pip resolve a patched deepdiff. Bump
 # both dbt-core and dbt-postgres together (no compatible dbt-common exists
 # that relaxes deepdiff without also raising the protobuf floor).
-dbt-core==1.12.2
+# dbt-core 1.12.3 widens the sqlparse constraint to >=0.5.5,<0.7.0, allowing
+# pip to resolve sqlparse 0.6.0 (fixed for CVE-2026-54284, CVE-2026-59893,
+# CVE-2026-59894, CVE-2026-71491). Pin sqlparse>=0.6.0 explicitly to ensure
+# the patched version is always installed.
+dbt-core==1.12.3
 dbt-postgres==1.11.0
 deepdiff>=8.6.2
+sqlparse>=0.6.0